From: Anthony Minessale <anthm@freeswitch.org>
Date: Wed, 16 Sep 2015 03:19:12 +0000 (-0500)
Subject: FS-8169 Fixed uuid_displace on stereo channels can lead to memory corruption causing... 
X-Git-Tag: v1.4.23~8
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5844c10fddaa2209e8ed87a78c06f4ddddeb551c;p=thirdparty%2Ffreeswitch.git

FS-8169 Fixed uuid_displace on stereo channels can lead to memory corruption causing a crash
---

diff --git a/src/switch_ivr_async.c b/src/switch_ivr_async.c
index ab2568c615..966f035375 100644
--- a/src/switch_ivr_async.c
+++ b/src/switch_ivr_async.c
@@ -780,7 +780,7 @@ static switch_bool_t write_displace_callback(switch_media_bug_t *bug, void *user
 			} else {
 				st = switch_core_file_read(&dh->fh, rframe->data, &len);
 				if (len < rframe->samples) {
-					memset((char *)rframe->data + len * 2 * dh->fh.channels, 0, (rframe->datalen - len) * 2 * dh->fh.channels);
+					memset((char *)rframe->data + (len * 2 * dh->fh.channels), 0, (rframe->samples - len) * 2 * dh->fh.channels);
 				}
 			}